Bug 819303 - crash in nsTextEquivUtils::AppendTextEquivFromTextContent. f=marcoz r=surkov

accessible/src/html/HTMLTableAccessible.cpp

@@ -121,9 +121,11 @@ HTMLTableCellAccessible::NativeAttributes()
   if (ChildCount() == 1) {
     Accessible* abbr = FirstChild();
     if (abbr->IsAbbreviation()) {
-      nsTextEquivUtils::
-        AppendTextEquivFromTextContent(abbr->GetContent()->GetFirstChild(),
-                                       &abbrText);
+      nsIContent* firstChildNode = abbr->GetContent()->GetFirstChild();
+      if (firstChildNode) {
+        nsTextEquivUtils::
+          AppendTextEquivFromTextContent(firstChildNode, &abbrText);
+      }
     }
   }
   if (abbrText.IsEmpty())

accessible/tests/mochitest/attributes/test_obj.html

@@ -100,6 +100,9 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=558036
       testAttrs("th2", { "abbr": "SS#" }, true);
       testAttrs("th2", { "axis": "social" }, true);
 
+      // don't barf on an empty abbr element.
+      testAbsentAttrs("th3", { "abbr": "" }, true);
+
       // application accessible
       if (WIN) {
         var gfxInfo = Components.classes["@mozilla.org/gfx/info;1"].
@@ -154,6 +157,11 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=558036
      title="Expand support for nsIAccessibleEvent::OBJECT_ATTRIBUTE_CHANGE">
     Mozilla Bug 563862
   </a>
+  <a target="_blank"
+     href="https://bugzilla.mozilla.org/show_bug.cgi?id=819303"
+     title="crash in nsTextEquivUtils::AppendTextEquivFromTextContent">
+    Mozilla Bug 819303
+  </a>
   <p id="display"></p>
   <div id="content" style="display: none"></div>
   <pre id="test">
@@ -211,6 +219,7 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=558036
     <tr>
       <th id="th1"><abbr title="Social Security Number">SS#</abbr></th>
       <th id="th2" abbr="SS#" axis="social">Social Security Number</th>
+      <th id="th3"><abbr></abbr></th>
     </tr>
   </table>